SB2015011506 - Fedora 21 update for binutils

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2015011506

SB2015011506 - Fedora 21 update for binutils

Published: January 15, 2015 Updated: April 24, 2025

Security Bulletin ID SB2015011506
Severity
Medium
Patch available
YES
Number of vulnerabilities 2
Exploitation vector Remote access
Highest impact Denial of service

Breakdown by Severity

Medium 50% Low 50%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 2 secuirty vulnerabilities.


1) Path traversal (CVE-ID: CVE-2014-8737)

The vulnerability allows a local non-authenticated attacker to manipulate or delete data.

Multiple directory traversal vulnerabilities in GNU binutils 2.24 and earlier allow local users to delete arbitrary files via a .. (dot dot) or full path name in an archive to (1) strip or (2) objcopy or create arbitrary files via (3) a .. (dot dot) or full path name in an archive to ar.


2) Buffer overflow (CVE-ID: CVE-2014-8738)

The vulnerability allows a remote non-authenticated attacker to perform service disruption.

The _bfd_slurp_extended_name_table function in bfd/archive.c in GNU binutils 2.24 and earlier allows remote attackers to cause a denial of service (invalid write, segmentation fault, and crash) via a crafted extended name table in an archive.


Remediation

Install update from vendor's website.

References